SIGRed - 17 Year old DNS Vulnerability

[JeremyKerwin]

I'm sure many have heard about the recent DNS vulnerability titled SIGRed. This one looks pretty bad.

https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-se… 

I'm curious about how to best leverage NetWitness Logs Packets and Endpoint to best be prepared to detect and response to this sort of attack.

One of the detection suggestions is to detect large malformed DNS requests, is this easy to do with NW?

[DavidGassman2]

Suggest looking at implementing logic as follows:

1) identifying DNS responses larger than 64 K bytes

- you could create an AppRule similar to this:  service=53 && payload.res=64000-u

2) identifying DNS query type is SIG record

- this is currently parsed out as dns.querytype = 'sig record'  {assuming you have the DNS_verbose_lua parser enabled}

You could combine all of this into a single AppRule

[JeremyKerwin]

Thanks David, 

I have a play around with what you suggested. Thanks.

[drewjc]

From a querying standpoint are you using the session size buckets populated in the session analysis metakey? Or are you indexing payload response sizes?